0

Hi I have a test network set up with one vanilla Windows 2008 R2 domain controller, and a few Windows 7 and Windows XP clients logged in. I am trying to access workstation A from workstation B by logging in as a domain administrator onto workstation B, and typing \win7a-pc into windows explorer path bar.

I cannot connect this way until I disable the firewall completely on the workstations, and then I have no problems. Is it normal not to be able to access workstations this way without disabling the firewall on them?

Is it typical for corporate networks to be this restricted? Do they typically relax these restrictions or would this compromise security?

Thanks for any advice!

Improve this question

1 Answer 1

Reset to default
5

The firewall has no way of identifying who you are at this point, so whether or not you are a domain admin is irrelavent. Your TCP traffic is being blocked.

So, to allow access you are going to need to relax your firewall restrictions, be this by adding exceptions for file and print sharing (see here) or by disabling your firewalls on the domain network.

Improve this answer
5
  • Thanks for the fast reply! Would it be possible to create a special user with the ability to bypass the firewall for this purpose, without having to give that functionality to other users?
    – TripleAntigen
    Jul 30, 2011 at 14:12
  • No, firewall access is filtered on the type of data you are trying to send through the firewall, not the person sending it.
    – Sam Cogan
    Jul 30, 2011 at 14:17
  • Thanks Sam, I am developing software for auditing network systems, and access would be required to do that. Do you think in general that System Administrators would balk at disabling firewall functionality like that? How would other auditing tools access information on target systems if so?
    – TripleAntigen
    Jul 30, 2011 at 14:23
  • 1
    I can't speak for other system admins but I would point at you and laugh if you asked me to disable the firewall while your software was running. There's a number of ways of solving that problem, the simplest might be installing an agent on the workstations that can collect the information you are looking for.
    – Rob Moir
    Jul 30, 2011 at 14:42
  • @TripleAntigen: What you should do is identify what inbound ports your software needs open and then build your installer to issue a message to the user that the user needs to open those ports in the firewall.
    – joeqwerty
    Jul 30, 2011 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .